Do you need to register with the ICO?
Most UK organisations that hold personal data — customer records, employee files, even a CCTV camera — are legally required to register with the Information Commissioner's Office and pay an annual data protection fee. A minority are exempt. For a flat £29, we tell you which one you are.
What happens if you don't register?
The ICO issues fixed penalties to organisations required to register that haven't. This is a separate, much smaller regime from the multi-million-pound fines for actual data breaches — see below.
The ICO sends a reminder, then a 28-day notice of intent, before issuing a fixed penalty. Real recent examples: Vattenfall Wind Power Ltd (Tier 3, £4,000), Aldershot Town Football Club Limited (Tier 2, £600), Visaura Ltd (Tier 2, £600) — see the ICO's current enforcement notices. These fixed penalties are entirely separate from (and far smaller than) fines for actual data protection breaches, which can reach £17.5m under UK GDPR — a different legal regime. Source: ICO fixed penalty guidance.
Why ICO registration matters
The ICO is the UK's independent regulator for information rights — and it's not just a paperwork exercise for you. It's who your own customers, employees, and suppliers can complain to.
Anyone can complain about you
If a customer, employee, or member of the public thinks you've mishandled their personal data, they can raise it directly with the ICO — free of charge, at any time.
The ICO investigates
A complaint can trigger a real inquiry into how your organisation handles data — and an unregistered organisation that should have registered is an easy first finding.
Real enforcement powers
The ICO can issue warnings, reprimands, enforcement notices, and fines. Registration is the baseline that shows you're accountable before any of that becomes relevant.
Start with the £29 determination
Tell us your business name and a little about how you use personal data. We check that against the ICO's fee tiers and exemption categories and email you the result, usually within one business day.
- ✓ Exempt — you're classed “Tier 0.” We email a dated PDF certificate explaining why, for your records.
- ✓ Not exempt — we confirm your exact fee tier and the amount, before you pay anything further.
Find your business
Search Companies House to jump straight to your order with your business pre-filled.
Not on Companies House (sole trader, unincorporated club)? No problem — start the determination and enter your details directly.
If you do need to register
The ICO fee is set by tier, based on your organisation's size. Your determination confirms which one applies — here's what each looks like.
| Tier | Annual fee |
|---|---|
| Tier 1 Micro organisation | £52 /yr |
| Tier 2 SME | £78 /yr |
| Tier 3 Large organisation | £3,763 /yr |
ICO fees are set by the Information Commissioner's Office and are subject to change; source: ico.org.uk. Our example totals below reflect the current rate.
Full registration service
Once your tier is confirmed, we complete your ICO registration and pay the fee on your behalf. You provide your details once — we handle the rest.
- ✓ We complete your ICO registration
- ✓ ICO fee included in your total, paid on your behalf
- ✓ Confirmation of your ICO register entry
Example totals
All prices in GBP.
Not sure where you stand?
Get a clear answer for £29 — a dated certificate if you're exempt, or your exact fee tier if you're not.
Frequently asked questions
Common questions about ICO registration, exemptions, and the data protection fee.
What does the £29 determination actually check? ▾
We look at what your organisation actually does with personal data and its size (turnover and staff count), and compare that against the exemption categories and fee tiers set out in the Data Protection (Charges and Information) Regulations 2018. If everything you do falls inside a narrow exempt purpose, you're “Tier 0” and don't owe the fee. Otherwise, we tell you exactly which tier and fee applies.
What are the exemption categories? ▾
You're only exempt if everything you do with personal data falls into one of these narrow purposes: staff administration only (payroll/HR for your own employees); advertising, marketing and PR for your own business only; your own accounts and records only; not-for-profit membership administration only; personal, family or household purposes; maintaining a public register required by law; or judicial functions. If you do anything beyond these — hold customer records, run an online service, use CCTV, employ a third-party processor — you'll need to register. The exemptions are narrow by design, which is exactly why most organisations end up registering.
What happens if I don't register when I should? ▾
The ICO can issue a fixed penalty: £400 for Tier 1 (micro), £600 for Tier 2 (SME), or £4,000 for Tier 3 (large) — up to £4,350 with aggravating factors. It's issued after a reminder and a 28-day notice of intent, not out of nowhere. Penalties can also follow a complaint — if someone reports your organisation to the ICO and it turns out you should have been registered, that's typically the first thing that comes up. This is a separate, much smaller regime from UK GDPR fines for actual data breaches (up to £17.5m) — the two are often confused, but they're different laws entirely. Source: ICO fixed penalty guidance.
I got the Tier 0 certificate — is that proof I'm registered? ▾
No — it's the opposite. The certificate is our dated record of why your organisation doesn't need to register at all, useful to show a client, auditor, or your own files if the question ever comes up. If your processing changes (e.g. you start handling customer data beyond accounts/marketing), the determination should be revisited.
How is the fee tier decided if I do need to register? ▾
Tier 1 (£52/yr) applies to micro organisations (turnover up to £632,000 and 10 or fewer staff). Tier 3 (£3,763/yr) applies to large organisations (turnover over £36 million or 250+ staff). Everything else is Tier 2 (£78/yr). We confirm the exact figure as part of your determination before you pay it.
Performance West Ltd is not the ICO and is not affiliated with any government body — this is a paid compliance service. You can also register directly at ico.org.uk.